The FBI and four other federal agencies warned that the recent supermarket freezer hacks in Europe could occur in the U.S. Their message to grocers across the country is direct: Take refrigeration controllers off the public internet and change default passwords now.
In a joint fact sheet, the Cybersecurity and Infrastructure Security Agency, the FBI and the departments of Health and Human Services, Agriculture and Transportation said attackers are targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. By exploiting unpatched or internet-accessible devices, hackers can remotely force units into “continuous heating and defrost cycles,” the agencies said.
For supermarkets, this is not just an IT problem. A single overnight intrusion can wipe out frozen and fresh inventory, shorten equipment life, create a fire hazard and, if spoiled products are eaten, harm consumers, according to the advisory.
The timing raises the stakes. Freezer cases are filling with turkeys and holiday items ahead of Thanksgiving on Nov. 26.
What Happened in Europe’s Supermarket Freezer Attacks
The first large wave hit France overnight Oct. 11-12, when attackers hijacked Danfoss refrigeration controllers and triggered defrost cycles, BleepingComputer reported. Chains named in reports included Intermarché, Coopérative U, Carrefour Market, Monoprix and Leclerc.
French Finance Minister Roland Lescure told Parliament that about 700 of the country’s roughly 10,000 supermarkets were affected, The Associated Press reported. Other outlets gave lower counts.
A second wave on Nov. 2 hit more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, according to BleepingComputer. Ahold Delhaize, parent of U.S. chains including Food Lion, Stop & Shop, Giant and Hannaford, had about 40 locations affected in Belgium and Luxembourg.
An ICA store manager in Sweden told broadcaster TV4 that freezer settings were changed overnight to 122 degrees Fahrenheit (50 degrees Celsius) and could not be reset. The store threw out its frozen food.
The attacks then moved beyond grocery. France’s national blood service, EFS, said temperature controls were altered at three sites and that the intrusion came through a third-party refrigeration equipment provider, “as with several affected retailers,” The Record reported.
Related Article: AI in Food Safety and Quality Control Reshapes Global Supply Chains
Why U.S. Grocers Should Take The FBI Warning Seriously
Federal officials say the weak points are basic and common.
“Attackers are getting in through controllers that are unpatched, reachable from the internet, or still using the default passwords listed in the manufacturer’s manual,” Brett Leatherman, head of FBI Cyber, said in a video released with the advisory.
Thousands of these devices remain exposed. Reuters found at least 4,500 Danfoss web interfaces visible online on Oct. 13 using the Shodan search engine, according to a compilation of reporting by ComplexDiscovery.
The United States has its own warning signs. U.S. military officials have been working with French law enforcement on refrigerator outages at U.S. military commissaries, Cybersecurity Dive reported.
No group has claimed responsibility for the European attacks, according to The Record. That uncertainty makes it hard to predict who could be targeted next.
The French blood service case also shows that preparation pays off.
“The alarms went to the right people, the staff responded, and in this case no blood was lost,” Leatherman said.
8 Steps to Secure Refrigeration Controllers
The agencies urge owners and operators to take these cold chain cybersecurity steps “immediately”:
- Get off the public internet. Do not expose controller panels online. If you need remote access, put it behind an updated firewall or edge device.
- Isolate refrigeration systems. Place operational technology on a dedicated virtual local area network, separate from business networks.
- Lock down passwords. Change default passwords, enforce strong password policies, and use phishing-resistant multifactor authentication where feasible.
- Patch and replace. Keep firmware current and retire end-of-life controllers that manufacturers no longer support.
- Restrict access. Allow only approved devices and IP addresses to change settings.
- Back up. Keep current backups offsite and offline, and test them.
- Monitor. Turn on logging and review it for unexpected activity. Where logs are not available, collect network traffic between devices.
- Set safe limits. Define reasonable temperature setpoint ranges and set alerts for any deviation.
Questions to Ask Your Refrigeration Vendor
Many affected European stores were reached through outside service providers, so vendor oversight is central to the advisory. “Know how your vendors configure these devices,” Leatherman said.
Patching may not be enough. The director of Belgian refrigeration vendor Sabcobel said a software update alone would not fix affected units, which also need physical modifications, BleepingComputer reported.
Before the holiday rush, grocers can ask vendors:
- Which of our controllers can be reached from the internet?
- Who has remote access, and how is it secured?
- Are any of our controllers out of manufacturer support?
- Have all default passwords been changed?
- Will temperature alarms reach a manager at 3 a.m.?
How to Report A Suspected Attack
The agencies ask U.S. businesses to report suspicious activity to CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-SAY-CISA (1-844-729-2472), or to the FBI’s Internet Crime Complaint Center at ic3.gov or a local FBI field office.
Reports should include the date, time, and location of the incident; the type of activity; the equipment involved; and a company point of contact.
Thanksgiving Rush Is the Next Test
Investigations in Europe are ongoing, and the European Commission is working with national authorities on the attacks, Cybersecurity Dive reported.
For U.S. grocers, the practical deadline is closer. With Thanksgiving two weeks away, the agencies advise finding exposed controllers, closing remote-access gaps, and confirming alarms reach the right people before the freezers are full.